# Qubole Cross-Account Access Abused in the Wild: AWS Integration Role Assumption Campaign

> Wiz, with Sentra and Mandiant, observed a threat actor using IAM credentials from an AWS account associated with Qubole (805246085872) between Oct 14-26, 2026 to assume customer-created integration roles trusting that account. In victim environments the actor enumerated resources, harvested secrets, validated credentials with TruffleHog and read S3 data. No CVE is involved.

- **Published:** 2026-11-09T17:17:23Z
- **Last reviewed:** 2026-11-10T13:40:00.120Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5571
- **ID:** TL-2026-5571
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Wiz reports, with Sentra (which identified the suspicious activity) and Mandiant, that a threat actor abused IAM credentials from AWS account 805246085872, a legitimate Qubole-associated platform account, to call sts:AssumeRole on integration roles that customers had created to trust that account. Every attributed AssumeRole request supplied a valid External ID and succeeded. In most affected environments the roles had been otherwise unused in October and their trust policies were still in place. No vulnerability or CVE is involved; the activity abused vendor-trusted cross-account trust relationships and valid credentials.

Role assumptions began Oct 14, 2026 from a Mullvad VPN address (45.83.220.211) using IAM user principal AIDA3W7DIFLYOLTK63SFS. From Oct 15 most activity moved to an OVH VPS (57.129.54.120), and from Oct 18 the actor also used a second IAM user principal (AIDAJYRRH5Y3A7AAJM2HW), including role-assumption sweeps across multiple victim environments from a second Mullvad address (185.209.199.73). Activity from the OVH VPS ended Oct 26. Sessions used names with the prefix quiam- (for example quiam-enum, quiam-scope-full) and several Boto3 and aws-cli user agents on Linux hosts.

Post-assumption, the actor enumerated storage, compute, databases, identity and KMS keys; read Lambda environment variables via GetFunctionConfiguration, Secrets Manager secrets via ListSecrets/GetSecretValue and SSM Parameter Store values via DescribeParameters/GetParameter; and validated harvested AWS, Entra ID (service principal sign-ins) and Okta (OAuth client-credential token requests) credentials with TruffleHog (Oct 16-19). The actor opportunistically read any reachable S3 bucket (AssumeRole, ListBuckets, ListObjects/HeadObject, GetObject), sometimes downloading entire buckets in a single session.

Wiz also identified a possibly related bootable Linux ISO, sso_agent.iso, which starts a 90-minute timer, collects system information, uploads network interface and disk/partition lists to 57.129.54.120, polls that host on TCP 23458 and executes received input as a shell script, then hard-reboots when the timer expires. It loads the ntfs3 driver, suggesting a Windows target. Wiz has not identified deployments and cannot confirm its use. Separately, Oct 8-11 activity in which an actor tested customer-owned AWS access keys believed created for Qubole integrations (all tested within one hour on Oct 8, with a small number of environments compromised) has not been linked by Wiz to the role-assumption activity. Wiz sees no ties to other publicly reported activity and describes targeting as opportunistic, with unknown motivation.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1619 Cloud Storage Object Discovery
- T1087.004 Cloud Account
- T1552 Unsecured Credentials
- T1555.006 Cloud Secrets Management Stores
- T1530 Data from Cloud Storage
- T1090 Proxy
- T1571 Non-Standard Port
- T1583.003 Virtual Private Server
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1529 System Shutdown/Reboot
- T1588.002 Obtain Capabilities

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Assumed-Role Harvesting of Secrets Manager, SSM Parameters and Lambda Environment Variables (TL-2026-5571)** (`TL-2026-5571-SPL-002`)

Detects role sessions that read Secrets Manager (ListSecrets/GetSecretValue), SSM Parameter Store (DescribeParameters/GetParameter) and Lambda configuration (GetFunctionConfiguration, which exposes environment variables), the credential-harvesting stage of the Qubole integration-role campaign. Fires on the actor's quiam- session names, on actor IPs, or on behavioural breadth (two or more of the three services with 10+ calls in a session).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.006, T1552, T1526, T1580
- **Data sources:** aws_cloudtrail, index=aws sourcetype=aws:cloudtrail, AWSCloudTrail
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=aws sourcetype="aws:cloudtrail" "userIdentity.type"=AssumedRole
    ((eventSource="secretsmanager.amazonaws.com" eventName IN ("GetSecretValue","ListSecrets","BatchGetSecretValue"))
  OR (eventSource="ssm.amazonaws.com" eventName IN ("GetParameter","GetParameters","GetParametersByPath","DescribeParameters"))
  OR (eventSource="lambda.amazonaws.com" (eventName="GetFunctionConfiguration*" OR eventName="ListFunctions*")))
```Secrets then SSM then Lambda env-var reads inside one assumed-role session indicate credential harvesting```
| eval arn='userIdentity.arn', src_ip=sourceIPAddress, session=mvindex(split('userIdentity.arn',"/"),-1), svc=mvindex(split(eventSource,"."),0)
| stats count as calls dc(svc) as services dc(eventName) as distinct_apis values(svc) as service_list values(eventName) as apis min(_time) as first_seen max(_time) as last_seen by arn session src_ip userAgent recipientAccountId
| where like(session,"quiam-%") OR in(src_ip,"57.129.54.120","45.83.220.211","185.209.199.73","89.37.63.175") OR like(src_ip,"2001:41d0:70d:7800:%") OR (services>=2 AND calls>=10)
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen recipientAccountId arn session src_ip service_list apis calls userAgent
````

### Microsoft KQL

```kql
let iocIps = dynamic(["57.129.54.120","45.83.220.211","185.209.199.73","89.37.63.175"]);
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where UserIdentityType == "AssumedRole"
| where (EventSource == "secretsmanager.amazonaws.com" and EventName in ("GetSecretValue","ListSecrets","BatchGetSecretValue"))
    or (EventSource == "ssm.amazonaws.com" and EventName in ("GetParameter","GetParameters","GetParametersByPath","DescribeParameters"))
    or (EventSource == "lambda.amazonaws.com" and (EventName startswith "GetFunctionConfiguration" or EventName startswith "ListFunctions"))
| extend SessionName = tostring(split(UserIdentityArn, "/")[-1]), Svc = tostring(split(EventSource, ".")[0])
| summarize Calls = count(), Services = dcount(Svc), DistinctApis = dcount(EventName), ServiceList = make_set(Svc), Apis = make_set(EventName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserIdentityArn, SessionName, SourceIpAddress, UserAgent, RecipientAccountId
| where SessionName startswith "quiam-" or SourceIpAddress in (iocIps) or SourceIpAddress startswith "2001:41d0:70d:7800:" or (Services >= 2 and Calls >= 10)
```

### Sigma

```yaml
title: Secrets Manager, SSM and Lambda Config Harvesting by Actor Session or IP
id: 3f1c2a7e-5b4d-4e6a-9c1a-7d2e8b9a1c02
status: experimental
description: Detects Secrets Manager, SSM Parameter Store and Lambda configuration reads from assumed-role sessions using the quiam- prefix or actor IPs (TL-2026-5571). Volume thresholds are covered by the SPL and KQL forms.
references:
  - https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.credential-access
  - attack.t1555.006
  - attack.t1552
  - attack.discovery
  - attack.t1526
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_secrets:
    eventSource: secretsmanager.amazonaws.com
    eventName:
      - GetSecretValue
      - ListSecrets
      - BatchGetSecretValue
  selection_ssm:
    eventSource: ssm.amazonaws.com
    eventName:
      - GetParameter
      - GetParameters
      - GetParametersByPath
      - DescribeParameters
  selection_lambda:
    eventSource: lambda.amazonaws.com
    eventName|startswith:
      - GetFunctionConfiguration
      - ListFunctions
  selection_actor_session:
    userIdentity.arn|contains: '/quiam-'
  selection_actor_ip:
    sourceIPAddress:
      - '57.129.54.120'
      - '45.83.220.211'
      - '185.209.199.73'
      - '89.37.63.175'
  selection_actor_ip6:
    sourceIPAddress|startswith: '2001:41d0:70d:7800:'
  condition: (selection_secrets or selection_ssm or selection_lambda) and 1 of selection_actor_*
fields:
  - eventTime
  - recipientAccountId
  - userIdentity.arn
  - eventName
  - sourceIPAddress
  - userAgent
falsepositives:
  - Legitimate secret-rotation or backup tooling running under a role session from an unusual IP
  - Security scanners enumerating secrets and parameters
level: high
```

**Known false positives:**

- Secret-rotation, backup or configuration-management tooling reading many secrets and parameters under one role session
- Cloud security posture scanners and authorized pentests that enumerate secrets

**Tuning notes:** Allow-list known automation role ARNs and CI/CD sources, then tune the services>=2 / calls>=10 thresholds to your baseline. Pair with remediation: rotate every secret, SSM parameter and Lambda environment variable the matched role could read. Lambda event names carry version suffixes (for example GetFunctionConfiguration20150331v2), hence the prefix match.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AssumeRole with quiam- Session Name or Actor Boto3/aws-cli Fingerprint (TL-2026-5571) (locked: unlock with TL Creds)
- Bulk S3 Listing and Object Reads by Assumed-Role Session (TL-2026-5571) (locked: unlock with TL Creds)
- TruffleHog Credential Validation Against AWS, Entra ID and Okta (TL-2026-5571) (locked: unlock with TL Creds)
- Any AWS API Activity from Qubole Campaign Infrastructure IPs (TL-2026-5571) (locked: unlock with TL Creds)
- Cloud Resource and Identity Enumeration from quiam- Role Session (TL-2026-5571) (locked: unlock with TL Creds)
- [indicator] C2 Polling and Upload to [indicator] TCP/23458 (TL-2026-5571) (locked: unlock with TL Creds)
- Qubole Account 805246085872 AssumeRole from Actor Infrastructure or quiam- Session (TL-2026-5571) (locked: unlock with TL Creds)
- Role-Assumption Sweep Across Multiple Roles or Accounts from One Non-AWS Source (TL-2026-5571) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `57.129.54[.]120`
- File hash: `086d4a83181971e883c53a4c44f46da2`
- IP address: `45.83.220[.]211`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Trusted by Default: Qubole Cross-Account Access Abused in the Wild (Wiz)](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild)
- [Sentra (identified the suspicious activity)](https://sentra.io/)
- [Mandiant (investigation collaborator)](https://cloud.google.com/security/mandiant)
- [Wiz: Black Hat 2021 - How isolated is your AWS cloud environment? (cross-account background)](https://wiz.io/blog/black-hat-2021-aws-cross-account-vulnerabilities-how-isolated-is-your-cloud-environment)
- [Praetorian: AWS IAM Assume Role Vulnerabilities (External ID background)](https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities/)
- [Wiz: Experiencing an incident](https://www.wiz.io/experiencing-an-incident)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5571